Assurance

[Tom Scavo <>]

On Fri, Mar 7, 2014 at 2:39 PM, Steven Carmody 
<>
 wrote:
>
> So, beyond user education, what might people suggest as a way to detect,
> block, or prevent this sort of potentially-password-stealing approach, that
> could even handle some forms of two-factor ?

Sorry, I'm late to the party but this old blog article by Bruce
Schneier is relevant:

https://www.schneier.com/blog/archives/2005/04/more_on_twofact.html

Briefly, Schneier's recommendation is: authenticate the transaction,
not the user.

Tom